Back

CVE-2004-1187

Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use the same code, allows remote attackers to execute arbitrary code via long PNA_TAG values, a different vulnerability than CVE-2004-1188.

Published: Jan 10, 2005 Modified: Jun 16, 2026

CVSS Metrics

Affected Products (78)

Vendor Product Version
mplayer mplayer 0.90
mplayer mplayer 0.90_pre
mplayer mplayer 0.90_rc
mplayer mplayer 0.90_rc4
mplayer mplayer 0.91
mplayer mplayer 0.92
mplayer mplayer 0.92.1
mplayer mplayer 0.92_cvs
mplayer mplayer 1.0_pre1
mplayer mplayer 1.0_pre2
mplayer mplayer 1.0_pre3
mplayer mplayer 1.0_pre3try2
mplayer mplayer 1.0_pre4
mplayer mplayer 1.0_pre5
mplayer mplayer 1.0_pre5try1
mplayer mplayer 1.0_pre5try2
mplayer mplayer head_cvs
xine xine 0.9.8
xine xine 0.9.13
xine xine 0.9.18

…and 58 more

GitHub Security Advisory GHSA-xg3g-7232-qg4v

Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such...

References (10)

Risk Scores

CVSS Score 10.0 / 10
EPSS Score 5.18%

Top 8% most likely to be exploited

Threat Score 41.6 / 100

Data Sources

NVD EPSS GitHub